

A suspected hack-for-hire operation has been identified targeting journalists, activists, and government critics across the Middle East and North Africa, with indicators pointing to possible links with threat actors aligned to Indian state interests. The activity, analyzed by Access Now, Lookout, and SMEX, spans multiple years (2023–2025) and demonstrates a consistent focus on account compromise and long-term access rather than immediate malware deployment.

The campaign primarily relies on highly targeted spear-phishing and social engineering delivered through platforms such as LinkedIn, WhatsApp, iMessage, and email. Attackers frequently impersonate trusted services like Apple and Google, as well as recruiters offering job opportunities, in order to manipulate victims into revealing credentials or interacting with malicious links. In some cases, shortened URLs and redirect chains are used to mask the final phishing infrastructure.

A notable aspect of the operation is the abuse of Google OAuth 2.0 consent flows, where victims are tricked into authorizing attacker-controlled applications instead of directly entering passwords. This approach allows adversaries to gain persistent access to Google accounts through legitimate authorization mechanisms, especially when users are already authenticated. In parallel, more traditional credential-harvesting pages are also used when users are not logged in.

Infrastructure linked to the campaign includes multiple domains designed to impersonate services such as Apple, FaceTime, Signal, Telegram, and Android-related verification portals. Some of these domains overlap with infrastructure previously associated with Android spyware campaigns capable of exfiltrating sensitive data including contacts, SMS messages, device metadata, and local files, suggesting possible reuse of tooling or shared operational resources.

While most of the observed attacks did not result in confirmed full compromise, at least one case involving a Lebanese journalist led to a successful takeover of an Apple account, enabling persistent access via an added trusted device. Other targeted individuals reportedly managed to avoid full account infiltration.

Attribution remains uncertain, but Lookout links parts of the infrastructure and tactics to the “Bitter” threat cluster, previously associated with espionage operations aligned with Indian government interests. However, researchers note it is still unclear whether this represents direct activity by that group, an affiliated hack-for-hire operator leveraging shared infrastructure, or an expansion of targeting capabilities beyond historical patterns.

Overall, the campaign highlights the increasing convergence of phishing, OAuth abuse, and mobile-focused surveillance tooling in modern espionage operations, with a strong emphasis on identity compromise and long-term account access rather than traditional malware infection chains.

⚠️ Hack-for-Hire Campaign Targets Journalists in MENA via Phishing, OAuth Abuse & Fake Login Pages (Possible State-Linked Operation)